Hacker News Reader

Comment by azag0 | Hacker News Reader

Why would a news magazine website do this? Is it their ads that violate GDPR?

To completely block EU users to me at least implies greater degrees of data collection.

Why? Many other news websites simply force you to opt-in, which is illegal. It seems ad analytics are vitally important to their business model.

It's not though, they can still sell subscriptions and show ads without violating user's privacy.

> they can still sell subscriptions and show ads without violating user's privacy

At risk of going off topic, there are two issues at play. One, respecting users' privacy. And two, complying with GDPR. The former does not always mean the latter.

And even if one complies with GDPR, having material over which GDPR applies could result in frivolous complaints and costly regulatory interactions. It is reasonable for a newspaper with a mostly non-Europe to spend resources on other priorities.

But they still have the data of European residents. So merely blocking access to EU residents hasn't done much to lessen their GDPR liability, unless they've cleaned all their data.

> they still have the data of European residents

Source? Ensuring the permanent deletion of certain data, once, is easier than implementing an a new and complicated compliance regime.

There is no source needed that is a result of jurisdictions and national sovereignty

If China passed a law saying you must now delete all references to Tiananmen Square if you have nothing to expoae yourself to their legal jurisdiction you can keep it and literally tell them to get bent.

This is what I don't understand. Why did the LA Times add the IP filter in the first place? Why do they care if they get sued and/or fined by a foreign country? Let the EU block their IPs or DNS themselves if they feel like it.

To make money advertising to EU users, most advertisers probably have some EU presence, hence the ad network would too. Thus, the ad network might require their users to be GPDR-compliant.

From what I have read about GDPR here, the intent matters. By blocking EU ip addresses, they have shown their intent to not service the EU and therefore are exempt from GDPR.

But I certainly don’t know how much that effects their income and I doubt you do too. Maybe it’s not worth it without the tracking.

Because they don't have the technical knowledge to ensure compliance with 88 pages of mandates, maybe? If you violate GDPR you will be fined by the EU even if you do not exist in the EU.

But why would a news website per se need to collect or process user's personal data? If you don't, you don't have to care about GDPR at all.

Um, to sell more profitable ads.

They probably feel that the non-targeted ad revenue they would make from EU customers would not be worth the server costs, costs to comply with the law, and potential fine costs (risk).

Maybe or it could be that they don't have a data compliance officer, which is mandated by the GDPR. Or it could be that they just don't know what the issues are and have no clue how to get compliant. IP addresses are protected data and make you a data controller if you have log files.

The point is that if you are exercising the law to it's maximum extent then it is next to impossible not to collect personal data, even if you have no intention to.

For example, some hosting providers in Europe now automatically disable webserver logs unless the customer explicitly activates them to make sure they don't accidentally collect user data.

Now you might say, well if you run your own virtual server where you control all the services and know for a fact that no personal information is collected you won't run into that problem. But then you might still collide with the law because some network monitoring of the hosting provider might store connection logs. And it is on you to make sure that the companies you use for your business are compliant with the GPDR. You even need to have a contract with every single one of them with which you instruct them to process your users data and that they have to comply with the GPDR when doing so.

And even if you think everything you are doing is correct there are still some law firms that try to extort money from you by claiming some violation. In Germany this game of cat and mouse has already begun (and I don't mean the well known cases against Google, Facebook et. al)

> extort money from you

This isn't the US. You can't sue for GDPR non compliance, only complain to the authorities

FUD

It's funny that they have the technical knowledge to implement tracking (or outsource it to another company), but they don't have the technical knowledge to comply with GDPR (or outsource it to another company).

I'm looking forward to seing the first non-EU company (that has no EU offices) fined by the EU and the middle finger that will ensue.

Reply on news.ycombinator.com